a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
26/11/2023, 23:02

Target

a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3.dll
Size

2.0MB
MD5

dac0ea895b8048da299d083952e8ed90
SHA1

4de104c15fe52fe1b8fe06525f090583b4e7c25b
SHA256

a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3
SHA512

99b0a77352ce3eb509adeccdcc4a387e4893aee30dbbd42cbee15f7ed3bf3022c1ff79a0a04edc7a26e29155ebeae78a5829ab2875bf9245cf9b5c093e628ff8
SSDEEP

49152:SpW2WCN9mIFOKjQ5Tw2onUr1q7NWcPjH3hCbC5GMhE:SpW2WCDmIFOh5Twkq7NWsXh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	2132	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2496 wrote to memory of 2132	2496	rundll32.exe	28
PID 2132 wrote to memory of 2280	2132	rundll32.exe	29
PID 2132 wrote to memory of 2280	2132	rundll32.exe	29
PID 2132 wrote to memory of 2280	2132	rundll32.exe	29
PID 2132 wrote to memory of 2280	2132	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 268
    3⤵
    - Program crash
    PID:2280